Lector de Feeds

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-10041 Description libpam vulnerable to leaking hashed passwords. (CVE-2024-10041) References

• https://bugs.mageia.org/show_bug.cgi?id=34219
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/S3CBZDTRIQZKAUHHWFBJKJ7PYA7BPARL/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10041

SRPMS 9/core

• pam-1.5.2-5.2.mga9

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-32460 Description GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. (CVE-2025-32460) References

• https://bugs.mageia.org/show_bug.cgi?id=34218
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6QYCKFE7IU3HOGGUF42EURRWALAXSG4Z/
• https://lists.debian.org/debian-security-announce/2025/msg00067.html
• https://lists.suse.com/pipermail/sle-updates/2025-April/039065.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32460

SRPMS 9/core

• graphicsmagick-1.3.40-1.2.mga9

9/tainted

• graphicsmagick-1.3.40-1.2.mga9.tainted

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-31492 Description mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data. (CVE-2025-31492) References

• https://bugs.mageia.org/show_bug.cgi?id=34216
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/4RNEMKHJH72IHWVOIEQAKSXHOSDXQN3A/
• https://lists.debian.org/debian-security-announce/2025/msg00066.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3Z7RSITAKS2ICGANCQP2TDUHMS2LZDXR/
• https://ubuntu.com/security/notices/USN-7446-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31492

SRPMS 9/core

• apache-mod_auth_openidc-2.4.13.2-1.2.mga9

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-53034 , CVE-2025-21955 , CVE-2025-21956 , CVE-2025-21957 , CVE-2025-21959 , CVE-2025-21960 , CVE-2025-21962 , CVE-2025-21963 , CVE-2025-21964 , CVE-2025-21966 , CVE-2025-21967 , CVE-2025-21968 , CVE-2025-21969 , CVE-2025-21970 , CVE-2025-21971 , CVE-2025-21975 , CVE-2025-21978 , CVE-2025-21979 , CVE-2025-21980 , CVE-2025-21981 , CVE-2025-21986 , CVE-2025-21991 , CVE-2025-21992 , CVE-2025-21993 , CVE-2025-21994 , CVE-2025-21995 , CVE-2025-21996 , CVE-2025-21997 , CVE-2025-21999 , CVE-2025-22001 , CVE-2025-22003 , CVE-2025-22004 , CVE-2025-22005 , CVE-2025-22007 , CVE-2025-22008 , CVE-2025-22009 , CVE-2025-22010 , CVE-2025-22013 , CVE-2025-22014 , CVE-2025-22015 , CVE-2025-22018 , CVE-2025-22020 , CVE-2025-22021 , CVE-2025-22025 , CVE-2025-22027 , CVE-2025-22029 , CVE-2025-22033 , CVE-2025-22035 , CVE-2025-22038 , CVE-2025-22040 , CVE-2025-22041 , CVE-2025-22042 , CVE-2025-22043 , CVE-2025-22044 , CVE-2025-22045 , CVE-2025-22047 , CVE-2025-22048 , CVE-2025-22049 , CVE-2025-22050 , CVE-2025-22053 , CVE-2025-22054 , CVE-2025-22055 , CVE-2025-22056 , CVE-2025-22057 , CVE-2025-22058 , CVE-2025-22060 , CVE-2025-22063 , CVE-2025-22064 , CVE-2025-22066 , CVE-2025-22071 , CVE-2025-22072 , CVE-2025-22073 , CVE-2025-22074 , CVE-2025-22075 , CVE-2025-22077 , CVE-2025-22079 , CVE-2025-22080 , CVE-2025-22081 , CVE-2025-22083 , CVE-2025-22086 , CVE-2025-22088 , CVE-2025-22089 , CVE-2025-22090 , CVE-2025-22093 , CVE-2025-22095 , CVE-2025-22097 , CVE-2025-22119 , CVE-2025-23136 , CVE-2025-23138 , CVE-2025-37785 , CVE-2025-37893 , CVE-2025-38152 , CVE-2025-38240 , CVE-2025-38575 , CVE-2025-38637 , CVE-2025-39728 , CVE-2025-39735 Description Vanilla upstream kernel version 6.6.88 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34191
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.80
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.81
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.82
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.83
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.84
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.85
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.86
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.87
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.88
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-53034
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21955
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21956
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21957
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21959
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21960
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21962
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21963
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21964
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21966
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21967
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21968
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21969
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21970
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21971
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21975
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21978
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21979
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21980
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21981
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21986
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21991
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21992
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21993
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21994
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21995
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21996
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21997
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21999
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22001
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22003
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22004
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22005
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22007
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22008
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22009
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22010
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22014
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22015
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22020
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22021
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22025
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22027
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22029
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22035
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22038
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22040
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22041
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22042
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22043
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22045
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22047
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22048
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22049
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22050
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22053
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22054
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22055
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22056
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22057
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22058
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22060
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22063
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22064
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22066
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22071
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22072
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22073
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22074
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22075
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22077
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22079
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22080
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22081
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22083
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22086
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22088
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22089
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22090
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22093
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22095
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22097
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22119
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23136
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23138
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37785
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-37893
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38152
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38240
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38575
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38637
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39735

SRPMS 9/core

• kernel-linus-6.6.88-1.mga9

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-31650 , CVE-2025-31651 Description DoS via malformed HTTP/2 PRIORITY_UPDATE frame. (CVE-2025-31650) Bypass of rules in Rewrite Valve. (CVE-2025-31651) References

• https://bugs.mageia.org/show_bug.cgi?id=34231
• https://www.openwall.com/lists/oss-security/2025/04/28/2
• https://www.openwall.com/lists/oss-security/2025/04/28/3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31650
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651

SRPMS 9/core

• tomcat-9.0.104-1.mga9

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-23016 Description FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c. (CVE-2025-23016) References

• https://bugs.mageia.org/show_bug.cgi?id=34222
• https://www.openwall.com/lists/oss-security/2025/04/23/4
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23016

SRPMS 9/core

• fcgi-2.4.0-22.1.mga9

Publication date: 05 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-43903 Description NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. (CVE-2025-43903) References

• https://bugs.mageia.org/show_bug.cgi?id=34238
• https://ubuntu.com/security/notices/USN-7471-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43903

SRPMS 9/core

• poppler-23.02.0-1.6.mga9

Publication date: 05 May 2025
Type: bugfix
Affected Mageia releases : 9
Description Due to an script error introduced in the previous update mariadb server was not able to start on a clean install. Updated installations were not affected. However, this update makes mariadb work on clean and updated installations. References

• https://bugs.mageia.org/show_bug.cgi?id=34200

SRPMS 9/core

• mariadb-11.4.5-3.mga9

In Mageia/9/x86_64: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/9/aarch64: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/9/armv7hl: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/9/i586: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/cauldron/x86_64: Rachota is a portable application for timetracking different projects. It runs everywhere. It displays time data in diagram form, creates customized reports and invoices or analyses measured data and suggests hints to improve user's time usage. The totally portable yet personal timetracker.

In Mageia/cauldron/i586: Rachota is a portable application for timetracking different projects. It runs everywhere. It displays time data in diagram form, creates customized reports and invoices or analyses measured data and suggests hints to improve user's time usage. The totally portable yet personal timetracker.

In Mageia/cauldron/i586: A program to convert images from PPM format into the control language for the Alps Micro-Dry printers, at various times sold by Citizen, Alps and Okidata. This program drives the Alps Micro-Dry series of printers, including the Citizen Printiva series, Alps MD series, and Oki DP series (but not yet the DP-7000). In the current release, the program drives the standard mode fairly well; the dye sublimation mode very well; and the VPhoto mode reasonably well. It supports all the colours available up to the DP-5000, including the foil colours.

In Mageia/cauldron/x86_64: A program to convert images from PPM format into the control language for the Alps Micro-Dry printers, at various times sold by Citizen, Alps and Okidata. This program drives the Alps Micro-Dry series of printers, including the Citizen Printiva series, Alps MD series, and Oki DP series (but not yet the DP-7000). In the current release, the program drives the standard mode fairly well; the dye sublimation mode very well; and the VPhoto mode reasonably well. It supports all the colours available up to the DP-5000, including the foil colours.